oscerd opened a new issue, #1850:
URL: https://github.com/apache/camel-kafka-connector/issues/1850
## Background
#1734 crashed on Kafka Connect 4.x with `NoSuchMethodError:
org.apache.kafka.common.utils.Utils.mkSet` because
`io.apicurio:apicurio-registry-utils-converter:2.5.11.Final` (declared in
`core/pom.xml`) transitively dragged in a stale `connect-json:3.6.1`.
That symptom is **already resolved** in 4.22.0 (#1779 / #1778):
`connect-json` is pinned to `${kafka.version}` in `parent/pom.xml`
`<dependencyManagement>`, so every module resolves it to 4.2.1 regardless of
what apicurio requests. Verified on current main:
```
\- io.apicurio:apicurio-registry-utils-converter:jar:2.5.11.Final:compile
\- org.apache.kafka:connect-json:jar:4.2.1:compile
```
So this is **optional hygiene**, not a bug.
## The latent concern
`apicurio.registry.version` is still `2.5.11.Final` (unchanged since 2024,
`parent/pom.xml:33`). That release was built against the Kafka 3.6 Connect
APIs, and we now force-upgrade its `connect-json` to 4.2.1 through the pin. It
works today, but it leaves a small latent binary-compatibility risk if apicurio
uses a `connect-json` API that changed between 3.6 and 4.2.
## Version landscape (Maven Central, checked 2026-10-27)
`io.apicurio:apicurio-registry-utils-converter`:
- current in CKC: **2.5.11.Final** (2024)
- latest 2.x: **2.6.13.Final**
- latest 3.x: **3.3.3** (2026-09-08)
Of note: in `2.6.13.Final` and `3.3.3` the artifact declares `connect-json`
/ `connect-api` with `<scope>provided</scope>`, whereas in `2.5.11.Final`
`connect-json` reaches us at `compile` scope. A `provided` transitive
dependency is not propagated to consumers, so a bump to 2.6.x+ would likely
stop the `connect-json` leak at the source and make the pin redundant for the
apicurio path.
## Caveats before bumping
apicurio changed its artifact layout and transitive set across 2.5 → 2.6 →
3.x (the `apicurio-common-rest-client-*` / `io.apicurio.rest.client.auth.Auth`
split surfaced in the #1734 comments). So any bump must be:
1. verified on Maven Central for the exact coordinates we end up using,
2. **build-tested** on the full reactor to catch `NoClassDefFoundError`-type
transitive breakage,
3. integration-tested for the connectors that actually use the apicurio
converter.
## Suggested action
Low priority. When convenient, evaluate bumping to the latest 2.x
(`2.6.13.Final`) as the lowest-risk step — or to 3.x to track the current line
— and drop or keep the `connect-json` pin accordingly. Not urgent: the shipped
behaviour is already correct.
---
_Claude Code on behalf of Andrea Cosentino_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
